Occ Health EHR MIS Draft SOO - 04.22.2026.pdf

Department of Homeland Security | Office of Health Security Occupational Health Electronic Health Record & Medical Information System Statement of Objectives - DRAFT April 14, 2026

STATEMENT OF OBJECTIVES (SOO)

1. BACKGROUND AND OBJECTIVE

The Department of Homeland Security (DHS), Office of Health Security (OHS), seeks to license and implement a commercial, configurable Occupational Health Electronic Health Record / Management Information System (Occ Health EHR/MIS) to support the health and readiness of DHS civilian personnel— particularly law enforcement and other safety-sensitive roles—across the full employment lifecycle, from pre-placement through retirement or separation.

Current occupational health capabilities across Components are fragmented, largely encounter-based, and oriented toward clinical documentation rather than longitudinal medical surveillance and case management.

DHS requires a unified solution that:

• Serves as the authoritative occupational health record and repository for each employee;

• Supports both direct clinical care and “exam-review-only” workflows;

• Enables exposure-informed, policy-driven decisions based on longitudinal trends and medical surveillance; and

• Provides secure, role-appropriate, cross-Component visibility into workforce medical readiness and health outcomes.

To meet these needs, DHS intends to license a commercially available Occ Health EHR/MIS that combines encounter-based clinical documentation with robust medical surveillance, longitudinal review, and case-management capabilities, operating within the DHS security boundary and emphasizing configuration and standards-based integration over custom development.

2. SCOPE

The DHS Occ Health EHR/MIS shall:

• Support occupational health activities for approximately 200,000 DHS civilian employees across all DHS Components (excluding U.S. Coast Guard uniformed personnel), with headroom for growth.

• Provide a unified platform that:

o Allows Component-specific configuration of workflows, encounter types, medical standards, and business rules;

o Maintains a common enterprise data model to enable cross-Component reporting, longitudinal surveillance, and analytics;

DRAFT

Statement of Objectives - DRAFT April 14, 2026 o Supports both direct-care clinics (e.g., United Stated Secret Service (USSS) clinics, Federal Law Enforcement Training Center (FLETC) health units, OHS Workforce Care Clinic) and Components that primarily ingest and review exam results from external providers.

• Address both:

o Clinical repository/EHR needs (encounter-based documentation, lab results, imaging, exams, scanned outside records); and o Medical surveillance and case-management needs (longitudinal trend review, clearance/fitness decisions, clinical overrides, exposure-based cohorts and programs).

• Cover, at a minimum, the following functional domains:

o Employee health examinations (pre-placement, periodic, fitness-for-duty, exit);

o Workplace injury, illness, and exposure documentation and return-to-work (RTW) management;

o Drug and alcohol testing program workflows;

o Immunizations and occupational surveillance programs;

o Workforce medical readiness and clearance management;

o Longitudinal medical surveillance and case management (including clinical override documentation and tracking);

o Employee wellness support and de-identified population-level analytics;

o Occupational data governance, privacy, and access control.

• Integrate with DHS and Component systems, including, as applicable:

o HR and personnel systems (e.g., NFC, USA Staffing, Component HRMS) for identity, position, and organizational data;

o External exam providers or clinics and other nationwide occupational medicine vendors);

o Laboratory, device, and ancillary systems (e.g., audiometers, spirometers, point-of-care test devices);

o DHS identity, access management, and security monitoring environments;

o DHS enterprise analytics platforms for reporting and decision support.

3. DESIRED SOLUTION ARCHITECTURE

The solution shall:

• Be a commercially available, configurable Occ Health EHR/MIS platform (not a custom-built system), capable of deployment within the DHS cloud environment.

• Provide an integrated architecture that includes:

o A core clinical/occupational health EHR layer for encounters, documentation, orders, results, and storage of structured and unstructured clinical data;

o An occupational/exposure data layer that maintains longitudinal, exposure-centric employee records (locations, roles, tasks, Similar Exposure Groups, hazards, surveillance participation, incidents, controls, and related health outcomes); and o A CRM-style case-management layer that supports outreach, notifications, reminders, follow-up, and tracking of services and decisions for exposed or high-risk employees and other defined cohorts.

• Support both direct-care clinical sites and “exam-review-only” Components using a common code base and shared enterprise data model.

• Support Component-specific configuration (e.g., templates, workflows, standards) while preserving a unified data model that allows enterprise-wide reporting and analytics.

4. PERFORMANCE OBJECTIVES

The Contractor shall deliver a solution that enables DHS to achieve the following performance objectives.

Objective 1 – Unified and Longitudinal Employee Occupational Health Record

The solution shall:

• Provide a single, authoritative occupational health record for each DHS employee, accessible to authorized occupational health users across Components, with appropriate Component-level segregation and view restrictions.

• Support the full employee lifecycle, including pre-placement, periodic, problem-focused, post-exposure, and exit examinations, with linkage to relevant exposures, job roles, and programs.

• Organize data at the encounter level while also supporting longitudinal views that aggregate data across multiple encounters and years for each employee.

• Support reuse of exam and surveillance data (e.g., pre-employment examinations, baseline labs, immunizations, fit testing) across Components where policy permits, reducing duplicative examinations.

• Provide a concise, configurable “Exposure and Occupational Summary” view at the employee level, aggregating:

o Job history and duty locations;

o Known or potential occupational and environmental exposures and relevant incidents;

o Participation in surveillance programs and key clinical findings related to those exposures;

o Current and historical fitness/clearance statuses.

Objective 2 – Occupational Data Governance, Privacy, and Access Control

• Enforce separation of occupational health records from general clinical/treatment records and clearly distinguish occupational encounters from non-occupational encounters where both exist.

• Implement granular role-based access controls (RBAC) and encounter-type–specific access that:

o Restrict full occupational health content to designated occupational health roles;

o Provide “minimum necessary” views for HR, supervisors, safety, and other non-clinical stakeholders (e.g., work status, restrictions, and clearance determinations without underlying diagnoses or detailed clinical data);

o Segregate and further protect mental/behavioral health, EAP-related occupational data, and other specially protected categories.

• Support audit logging of all access to employee records and all disclosures to HR/supervisors, with reporting to satisfy compliance and oversight needs.

• Support configuration to comply with OSHA 1910.1020, ADA, GINA, HIPAA, the Privacy Act, applicable state privacy laws, and DHS privacy and security policies.

• Allow DHS to configure data-sharing rules by Component, role, encounter type, and data element without vendor code changes.

Objective 3 – Medical Surveillance, Longitudinal Review, and Exposure-Informed Decision Support

• Provide a configurable medical surveillance engine capable of:

o Defining surveillance panels (e.g., respiratory protection, hearing conservation, TB, bloodborne pathogens, lead, ergonomics, specific chemical/physical agents) with associated exams, labs, tests, and intervals;

o Mapping surveillance panels to job roles, tasks, known exposures, Similar Exposure Groups, and locations;

o Automatically enrolling employees into appropriate programs based on HR/position data and exposure information;

o Generating recall lists and reminders for due or overdue surveillance elements.

• Aggregate data across multiple encounters and years so clinicians can efficiently review longitudinal health history (e.g., comparison across annual physicals, lab trends, imaging, and other key indicators) to make policy-driven and exposure-informed decisions.

• Support documentation and tracking of clinical interpretation “overrides” where policy or clinical judgment justifies accepting values that may be flagged as abnormal (e.g., lab values outside generic reference ranges but acceptable based on DHS standards or individual context). These overrides shall be visible in longitudinal review and auditable over time.

• Support structured clearance/fitness-for-duty workflows that incorporate surveillance results, longitudinal trends, and clinical overrides into final determinations.

• Provide medical readiness dashboards and reports that:

o Display compliance with required surveillance and readiness standards by unit, Component, and enterprise;

o Identify employees not medically ready or with outstanding requirements;

o Allow drill-down to individual and program-level details.

Objective 4 – Injury, Illness, Exposure, and Return-to-Work Management

• Enable consistent documentation of workplace injuries, illnesses, and exposures, including linkage to job, location, exposure programs, and Similar Exposure Groups where applicable.

• Support documentation of both acute and chronic exposures (chemical, physical, biological, ergonomic, and other relevant categories), as well as near-miss or incident reports.

• Link injury/illness/exposure events to relevant surveillance programs and follow-up requirements.

• Generate OSHA 300, 300A, and 301 forms and OSHA-required logs and reports.

• Support creation of documentation needed for FECA and other workers’ compensation claims, including structured data capture, narrative reports, and attachments.

• Support structured RTW workflows, including:

o Documentation of work status (fit, restricted, not fit) and specific restrictions;

o Time-bounded restrictions and scheduled re-evaluation;

o Secure, role-appropriate notifications to supervisors and HR consistent with privacy requirements.

• Allow configuration of specialty workflows (e.g., post-exposure prophylaxis follow-up, critical incident response) without custom development.

Objective 5 – Interoperability and Integration

• Implement standards-based interoperability (e.g., HL7 FHIR R4, HL7 v2.x, USCDI) to:

o Exchange data with labs and, where applicable, immunization registries;

o Integrate with federal and Component HR systems and DHS identity services;

o Ingest structured and unstructured data from external exam providers other contracted clinics);

o Support data export to DHS enterprise analytics environments.

• Provide APIs and integration patterns suitable for DHS’s current and future IT environment, enabling:

o Integration with HR and personnel systems (e.g., NFC, USA Staffing, Component HRMS) for employee demographics, position, and organizational information;

o Integration with DHS identity/access management services for user authentication and provisioning;

o Integration with devices and ancillary systems (e.g., audiometers, spirometers, point-of-care test devices, external laboratory and radiology systems).

• Support configuration of interface endpoints and mappings without modifying core source code (e.g., through configuration, mapping tools, or standard interface engines).

• Support export of identified and de-identified data, via APIs or secure data feeds, to DHS enterprise analytics platforms for surveillance, program evaluation, and decision support.

Objective 6 – Security, Hosting, and ATO

• Be deployable within a DHS-approved cloud environment with FedRAMP Moderate authorization (at minimum), with all DHS data physically and logically residing within the continental United States.

• Integrate with DHS SOC monitoring and enterprise security tools (e.g., logging, SIEM, vulnerability management) and expose required logs and events.

• Support DHS in achieving and maintaining an Authority to Operate (ATO) within mutually agreed timelines by providing:

o System security documentation (e.g., SSP, configuration guides);

o Support for security testing, remediation, and continuous monitoring;

o Timely updates and security patches.

• Provide mechanisms for encryption in transit and at rest, key management compatible with DHS requirements, and configurable retention and archival policies that meet occupational record-keeping requirements (including long-term retention and legal holds).

Objective 7 – Scalability, Configurability, and User Adoption

• Scale to support at least 200,000 DHS civilian employees, with headroom for growth and potential expansion to additional user groups, without major redesign.

• Support configuration (by DHS administrators) of:

o Encounter types, templates, and forms;

o Surveillance programs/panels and eligibility rules;

o Workflows and approval paths;

o RBAC roles and permissions;

o Component-specific picklists, standards, and business rules;

o Dashboards and standard reports.

• Provide user interfaces optimized for occupational health workflows that minimize clicks, support common shortcuts, and reduce reliance on paper.

• Include robust training and change-management support, including:

o Role-based training materials and sessions;

o “Train-the-trainer” capabilities;

o Support during go-live and early operations (e.g., onsite/virtual floor support).

• Provide configurable reporting tools and dashboards for local and enterprise users without requiring vendor intervention for routine report development.

Objective 8 – Implementation, Data Migration, and Operations

The Contractor shall:

• Support DHS in refining detailed requirements and configuration during implementation, using agile or iterative methods as appropriate.

• Plan and execute data migration from legacy occupational health systems and data sources, including:

o Assessment and mapping of legacy data (structured systems, paper records, scanned PDFs, spreadsheets);

o Data quality and cleansing support, including strategies for incomplete or inconsistent location and exposure data;

o Validation and reconciliation processes to ensure data integrity in the new system.

• Provide environments for development, testing, training, and production, with defined processes and controls for configuration promotion.

• Provide ongoing operations and maintenance, including:

o Software updates and security patches;

o Help desk/support services with agreed service levels;

o Performance and availability monitoring and reporting.

5. CONSTRAINTS

• Commercial Solution: The Government intends to acquire a commercially available solution and does not plan to fund extensive custom software development.

• Configuration-First Approach: Where feasible, requirements should be met through configuration and standards-based integration rather than custom code.

• Data Location: All DHS data must reside within the DHS cloud environment and within the continental United States.

• Compliance: The solution must comply with all applicable laws, regulations, and DHS policies, including but not limited to OSHA, ADA, GINA, HIPAA, the Privacy Act, FISMA, and DHS security directives.

• Performance: The system should meet availability and performance requirements (to be defined in detail in future documents) sufficient to support mission-critical operations in Components with 24/7 responsibilities.

6. ROLES AND RESPONSIBILITIES (HIGH-LEVEL)

Government (DHS/OHS and Components):

• Provide access to occupational health, HR, IT, privacy, and security subject-matter experts.

• Define and prioritize Component-specific workflows and configuration requirements.

• Provide access to relevant systems and data sources for integration and migration.

• Establish and maintain policy guidance for clinical overrides, data sharing, and longitudinal tracking to guide system configuration and use.

• Lead change management within DHS and Components.

Contractor:

• Provide and configure the Occ Health EHR/MIS to meet DHS requirements, consistent with this SOO.

• Support requirements refinement, solution design, implementation, data migration, testing, training, and transition to operations.

• Assist DHS in integration with HR, identity, security, and analytics environments.

• Support DHS in preparation for and completion of ATO, including ongoing security posture management.

• Provide ongoing operations, maintenance, and support, including updates, security patches, and agreed service levels.